fix: paid seated event attendee privacy #25258

dhairyashiil · 2025-11-18T20:10:43Z

What does this PR do?

Fixes Seated Events with paid booking exposes all attendee emails #25256
Fixes CAL-6782

Visual Demo

Tested for both scenarios

when toggle is off
when toggle is ON

Screen.Recording.2025-11-19.at.3.07.46.PM.mov

Summary by cubic

Fixes attendee privacy for paid seated events by sending seat-specific notifications after payment and honoring seatsShowAttendees. Addresses #25256 and CAL-6782 to prevent exposing other attendees’ details to each buyer.

Bug Fixes
- Use sendScheduledSeatsEmailsAndSMS for seated events, emailing only the attendee who just completed payment.
- Defer confirmation emails for paid seats until payment succeeds and respect workflow settings that disable standard host/attendee emails.
- Link each booking seat to its paymentId and select the paying attendee when sending emails to avoid misrouted confirmations.
Migration
- Add paymentId to BookingSeat with a unique index to track seat payments.

^{Written for commit 16b0760. Summary will update automatically on new commits.}

vercel · 2025-11-18T20:10:50Z

@dhairyashiil is attempting to deploy a commit to the cal Team on Vercel.

A member of the Team first needs to authorize it.

cubic-dev-ai

2 issues found across 6 files

Prompt for AI agents (all 2 issues)


Understand the root cause of the following 2 issues and fix them.


<file name="apps/web/modules/bookings/views/bookings-single-view.tsx">

<violation number="1" location="apps/web/modules/bookings/views/bookings-single-view.tsx:169">
The Stripe polling loop always reloads the page every 2s until payment succeeds, so a failed/slow payment traps the user in an infinite reload loop.</violation>

<violation number="2" location="apps/web/modules/bookings/views/bookings-single-view.tsx:429">
Wrap the new &quot;Processing payment&quot; headline in t() so it participates in localization.</violation>
</file>

_{Reply to cubic to teach it or ask questions. Re-run a review with @cubic-dev-ai review this PR}

apps/web/modules/bookings/views/bookings-single-view.tsx

…nt-attendee-privacy

anikdhabal

In order to fix this issue, let's follow these steps:

Store the paymentId in the bookingSeat table.
After a successful payment, query the seat using the passed paymentId to find the attendee/seat, and then send them an email

…delivery - Add paymentId field to BookingSeat model for direct payment tracking - Update createNewSeat to link payment after seat creation - Update RegularBookingService to link payment for first seat bookings - Modify handlePaymentSuccess to use paymentId for accurate attendee identification - Update getBooking to include paymentId in bookingSeat queries - Add database migration for new paymentId column with unique index This fixes the race condition where payment webhooks arriving out of order could cause confirmation emails to be sent to the wrong attendee in paid seated events. Now each seat directly references its payment for accurate identification.

cubic-dev-ai

2 issues found across 7 files

Prompt for AI agents (all 2 issues)


Check if these issues are valid — if so, understand the root cause of each and fix them.


<file name="packages/features/bookings/lib/payment/getBooking.ts">

<violation number="1" location="packages/features/bookings/lib/payment/getBooking.ts:45">
Attendee phone numbers are fetched from Prisma even though the data is never used here, which unnecessarily exposes extra PII and goes against the guideline to select only required fields.</violation>
</file>

<file name="packages/prisma/migrations/20251127144146_add_payment_id_to_booking_seat/migration.sql">

<violation number="1" location="packages/prisma/migrations/20251127144146_add_payment_id_to_booking_seat/migration.sql:14">
Drop the redundant non-unique index on BookingSeat.paymentId; the unique index already covers lookups on this column and avoids extra storage/write overhead.</violation>
</file>

_{Reply to cubic to teach it or ask questions. Re-run a review with @cubic-dev-ai review this PR}

packages/features/bookings/lib/payment/getBooking.ts

packages/prisma/migrations/20251127144146_add_payment_id_to_booking_seat/migration.sql

- Remove redundant regular index on BookingSeat.paymentId (unique index already provides lookup capability) - Remove unused phoneNumber field from getBooking query (data never used in CalendarEvent) - Regenerate migration with optimized schema This reduces storage overhead and write operations while maintaining performance.

cubic-dev-ai

1 issue found across 7 files

Prompt for AI agents (all 1 issues)


Check if these issues are valid — if so, understand the root cause of each and fix them.


<file name="packages/prisma/schema.prisma">

<violation number="1" location="packages/prisma/schema.prisma:1629">
`paymentId` is marked `@unique`, preventing multiple seats from referencing the same payment. Group bookings usually share one payment record, so subsequent seats will violate the unique constraint and fail to save. Drop the uniqueness so all seats in a booking can link to the same payment.</violation>
</file>

_{Reply to cubic to teach it or ask questions. Re-run a review with @cubic-dev-ai review this PR}

packages/prisma/schema.prisma

…nt-attendee-privacy

cubic-dev-ai

2 issues found across 7 files

Prompt for AI agents (all 2 issues)


Check if these issues are valid — if so, understand the root cause of each and fix them.


<file name="packages/prisma/schema.prisma">

<violation number="1" location="packages/prisma/schema.prisma:1629">
`paymentId` is intended to point to `Payment`, but it is just a plain Int column with no foreign-key relation, so invalid/nonexistent payment IDs can be stored and Prisma cannot traverse `bookingSeat.payment`. Declare a relation to `Payment` so referential integrity is enforced.</violation>
</file>

<file name="packages/app-store/_utils/payments/handlePaymentSuccess.ts">

<violation number="1" location="packages/app-store/_utils/payments/handlePaymentSuccess.ts:114">
Email confirmation disabling logic for hosts and attendees duplicates `packages/features/bookings/lib/handleConfirmation.ts` and several other files. This logic should be extracted into a shared utility function.</violation>
</file>

_{Reply to cubic to teach it or ask questions. Re-run a review with @cubic-dev-ai review this PR}

packages/prisma/schema.prisma

packages/app-store/_utils/payments/handlePaymentSuccess.ts

github-actions · 2025-11-27T16:29:49Z

E2E results are ready!

Workflow #90414.2 latest results

packages/emails/email-manager.ts

packages/features/bookings/lib/handleSeats/create/createNewSeat.ts

anikdhabal · 2025-11-27T17:07:01Z

packages/prisma/migrations/20251127152324_add_payment_id_to_booking_seat/migration.sql

+/*
+  Warnings:
+
+  - A unique constraint covering the columns `[paymentId]` on the table `BookingSeat` will be added. If there are existing duplicate values, this will fail.


Check this wanings

This warning is normal and expected when adding a unique constraint. Since paymentId is a new column being added by this migration, there are no existing values in the database to conflict - all existing rows will have paymentId = NULL, which is allowed for unique constraints.

The migration will run successfully without any issues. This is just Prisma's standard safety reminder that appears whenever adding a unique constraint to warn about potential duplicate data (which doesn't apply in our case).

- Fix seatsShowAttendees default from undefined to false to prevent unintended attendee hiding - Remove unnecessary comments from createNewSeat for cleaner code

cubic-dev-ai

1 issue found across 7 files

Prompt for AI agents (all 1 issues)


Check if these issues are valid — if so, understand the root cause of each and fix them.


<file name="packages/features/bookings/lib/service/RegularBookingService.ts">

<violation number="1" location="packages/features/bookings/lib/service/RegularBookingService.ts:1838">
Attach the newly created bookingSeat to the attendee identified by the per-seat responses (email/phone), not always to the booker email, so that seat-specific emails/webhooks target the correct attendee.</violation>
</file>

_{Reply to cubic to teach it or ask questions. Re-run a review with @cubic-dev-ai review this PR}

packages/features/bookings/lib/service/RegularBookingService.ts

github-actions · 2025-12-05T00:26:59Z

This PR has been marked as stale due to inactivity. If you're still working on it or need any help, please let us know or update the PR to keep it active.

fix: paid seated event attendee privacy

9310d83

pull-request-size bot added the size/S label Nov 18, 2025

github-actions bot added the 🐛 bug Something isn't working label Nov 18, 2025

keithwillcode added the community-interns The team responsible for reviewing, testing and shipping low/medium community PRs label Nov 18, 2025

implemented all cases

9c211a2

pull-request-size bot added size/L and removed size/S labels Nov 19, 2025

github-actions bot added the High priority Created by Linear-GitHub Sync label Nov 19, 2025

dhairyashiil marked this pull request as ready for review November 19, 2025 09:41

dhairyashiil requested a review from a team as a code owner November 19, 2025 09:41

graphite-app bot added the community Created by Linear-GitHub Sync label Nov 19, 2025

cubic-dev-ai bot reviewed Nov 19, 2025

View reviewed changes

apps/web/modules/bookings/views/bookings-single-view.tsx Outdated Show resolved Hide resolved

apps/web/modules/bookings/views/bookings-single-view.tsx Outdated Show resolved Hide resolved

dhairyashiil added 3 commits November 19, 2025 15:42

revert unnecessary frontend code

9f8534b

Merge remote-tracking branch 'upstream/main' into fix/paid-seated-eve…

3c0c1c6

…nt-attendee-privacy

remove unnecessary db call

9f451e5

CarinaWolli requested a review from a team November 25, 2025 14:26

anikdhabal requested changes Nov 26, 2025

View reviewed changes

github-actions bot marked this pull request as draft November 26, 2025 15:52

anikdhabal closed this Nov 27, 2025

anikdhabal reopened this Nov 27, 2025

dhairyashiil marked this pull request as ready for review November 27, 2025 15:03

github-actions bot added the ❗️ migrations contains migration files label Nov 27, 2025

cubic-dev-ai bot reviewed Nov 27, 2025

View reviewed changes

packages/features/bookings/lib/payment/getBooking.ts Outdated Show resolved Hide resolved

packages/prisma/migrations/20251127144146_add_payment_id_to_booking_seat/migration.sql Outdated Show resolved Hide resolved

dhairyashiil marked this pull request as draft November 27, 2025 15:15

dhairyashiil marked this pull request as ready for review November 27, 2025 15:24

cubic-dev-ai bot reviewed Nov 27, 2025

View reviewed changes

packages/prisma/schema.prisma Show resolved Hide resolved

Merge remote-tracking branch 'upstream/main' into fix/paid-seated-eve…

e33fd82

…nt-attendee-privacy

cubic-dev-ai bot reviewed Nov 27, 2025

View reviewed changes

packages/prisma/schema.prisma Show resolved Hide resolved

packages/app-store/_utils/payments/handlePaymentSuccess.ts Show resolved Hide resolved

dhairyashiil added the ready-for-e2e label Nov 27, 2025

anikdhabal reviewed Nov 27, 2025

View reviewed changes

dhairyashiil marked this pull request as draft November 27, 2025 17:33

dhairyashiil added 3 commits November 27, 2025 23:04

refactor: Apply code review feedback

8f12ad2

- Fix seatsShowAttendees default from undefined to false to prevent unintended attendee hiding - Remove unnecessary comments from createNewSeat for cleaner code

refactor: Remove unnecessary comments from handlePaymentSuccess

1ebf5c0

refactor: Remove unnecessary comments from RegularBookingService

16b0760

dhairyashiil marked this pull request as ready for review November 27, 2025 17:41

cubic-dev-ai bot reviewed Nov 27, 2025

View reviewed changes

packages/features/bookings/lib/service/RegularBookingService.ts Show resolved Hide resolved

dhairyashiil requested a review from anikdhabal November 27, 2025 18:14

github-actions bot added the Stale label Dec 5, 2025

fix: paid seated event attendee privacy #25258

Are you sure you want to change the base?

fix: paid seated event attendee privacy #25258

Uh oh!

Conversation

dhairyashiil commented Nov 18, 2025 • edited by cubic-dev-ai bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

What does this PR do?

Visual Demo

Tested for both scenarios

Summary by cubic

Uh oh!

vercel bot commented Nov 18, 2025

Uh oh!

cubic-dev-ai bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

anikdhabal left a comment

Choose a reason for hiding this comment

Uh oh!

cubic-dev-ai bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

cubic-dev-ai bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

cubic-dev-ai bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

github-actions bot commented Nov 27, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

E2E results are ready!

Uh oh!

Uh oh!

Uh oh!

anikdhabal Nov 27, 2025

Choose a reason for hiding this comment

Uh oh!

dhairyashiil Nov 27, 2025

Choose a reason for hiding this comment

Uh oh!

cubic-dev-ai bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

github-actions bot commented Dec 5, 2025

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

dhairyashiil commented Nov 18, 2025 •

edited by cubic-dev-ai bot

Loading

github-actions bot commented Nov 27, 2025 •

edited

Loading